Information obligations a&f systems gmbh
Information obligations for new and existing customers of a&f systems gmbh
In the following we inform about the collection of personal data for
- Offers
- Order confirmation
- CRM system without merchandise management
- Data management
- Document management
- Electronic payments
- Financial accounting
- Calendar
- Sales contract
- Business partner contact details
- Cost estimate
- Customer service and support
- Reminders
- Project and development tickets
- Invoices
- Complaints
- Reservations
- Damage report
- Switchboard
- Transfer
- Contract management
- Sales to business customers
Personal data are all data that can be related to you personally, e.g. name, address, email addresses, telephone number.
1. Contact details and company data protection officer
Responsible according to article 4 paragraph 7 DS-GVO is a&f systems gmbh, Eleonorenstr. 20, 30449 Hannover, 0511-89880494, info@a-f.de. The operational data protection officer of a&f systems gmbh can be reached at the above address, for the attention of the data protection department, or at datenschutz@a-f.de
2. Purposes of data processing and legal foundations
The data will be collected, stored and, if necessary, passed on by us, as far as it
- Offers: …is necessary in order to make a declaration of intent which needs to be received and which contains all the essential elements of the contract and through which one contract is offered to another in such a way that the conclusion of the contract depends only on the consent of the recipient.
- Order confirmation: …is necessary in order to be able to inform the customer of the acceptance of an offer. The company that creates an order confirmation usually has previously created a quote for the delivery of the goods, for the quantity and the prices, or for a service and its prices.
- CRM system without merchandise management: …is necessary to enable the management of customer data (also known as ERP) in which no goods movements are recorded.
- Data management: …is necessary in order to implement a set of all methodical, conceptual, organisational and technical measures and procedures for the treatment of the resource data with the aim of introducing them with their maximum potential for use in the business processes and to guarantee an optimal use during operation.
- Document management: …is necessary to enable a database-supported administration of electronic documents of all kinds.
- Electronic payments: …is necessary in order to record payment orders still submitted as supporting documents on computer media and to process them in settlement transactions between credit institutions using the paperless data medium exchange procedure (cashless payment transactions).
- Financial accounting: …is required to record all payment transactions and valuations in a company. As part of operational accounting, financial accounting forms the basis for preparing profit and loss accounts and balance sheets that show the value of the company.
- Calendar: …is necessary to create and organize appointments in the calendar and, if necessary, to pass them on to other participants in the form of appointment invitations.
- Sales contract: …is necessary to provide the contractual services.
- Business partner contact details: …is required to collect contact data of business partners such as suppliers and interested parties, which is stored on paper or electronically, in order to achieve long-term interactions between two economic entities, oriented towards economic goals, from which businesses emerge.
- Cost estimate: …is necessary to calculate possible costs in advance for the recipient.
- Customer service: …is necessary in order to offer customers all the company’s services.
- Reminders: …is necessary in order to claim the payment owed by the debtor by the creditor. If the debt is due, the debtor is in default of payment due to the unsuccessful reminder according to § 286 BGB.
- Project and development tickets: …is required to enable customers, prospects and employees to communicate easily, using a ticket system.
- Invoices: …is necessary in order to create a document in which a company informs its customers of the payment due under a contract.
- Complaints: …is required to deal with any oral or written expressed dissatisfaction with a product or service from both internal and external customers. The causes can be actual defects or even misunderstandings or unrealistic expectations.
- Reservations: …is necessary in order to be able to mark the use of a certain object on a specific date or in a period of time in the future.
- Damage report: …is required to process damage reports from customers.
- Switchboard: …is required in order to receive calls at a central location, forward them or record call-backs.
- Transfer: …is necessary to be able to carry out a data transfer. Data are individual elements that are arranged in a row and represent information.
- Contract management: …is necessary to enable the supervision of contractual negotiations between client and contractor, the implementation of contracts and the execution of contract amendments for technical, scheduling, personnel or financial reasons.
- Sales to business customers: …is necessary in order to win business customers with special processes in the company. This is an attempt to sell goods and/or services to business customers.
The collection, storage and transmission therefore take place in the following cases
- Offers: …for the purpose of pre-contractual measures at the request of the concerned subject on the basis of Article 6 (1) sentence 1 letter b DS Block Exemption Regulation. Failure to provide these data may result in the interested party or customer not being able to receive an offer and a contract may not be concluded.
- Order confirmation: …for the purpose of the fulfilment of a pre-contractual measure on request of the concerned subject on the basis of Article 6 paragraph 1 sentence 1 letter b DS-GVO. Failure to provide these data may result in the loss of the ability to sell goods and services.
- CRM system …without merchandise management: for the purpose of fulfilling a contract with the concerned subject on the basis of Article 6 (1) sentence 1 letter b DS Block Exemption Regulation or for the purpose of pre-contractual measures at the request of the concerned subject on the basis of Article 6 (1) sentence 1 letter b DS Block Exemption Regulation. Failure to provide this information may result in goods and/or services not being delivered or not being delivered in a timely manner.
- Data management: …for the purpose of a legitimate interest, which is evaluated on a case-by-case basis by a balancing of interests where a legitimate interest precludes this (in particular in the case of children) on the basis of Article 6(1) sentence 1 letter f DS Block Exemption Regulation. Failure to provide these data can result in data not being used optimally and operational procedures being stalled as a result.
- Document management: …for the purpose of pre-contractual measures at the request of the concerned subject on the basis of Article 6(1) first sentence DS Block Exemption Regulation and for the purpose of fulfilling the contract and on the basis of Article 6(1) first sentence DS Block Exemption Regulation. If these data are not made available, documents may not be used optimally, they may not be found, and operational processes may become stalled.
- Electronic payments: …for the purpose of performing a contract with the concerned subject on the basis of Article 6(1), first sentence, point (b) of the DS Block Exemption Regulation. Failure to provide these data may result in the impossibility of making payments on outstanding receivables and collecting liabilities.
- Financial accounting: …for the purpose of fulfilling a legal obligation of the person responsible on the basis of Article 6 paragraph 1 sentence 1 letter c DS-GVO. Failure to provide these data may result in the company being unable to comply with legal requirements, which may lead to warnings and dismissals of affected employees.
- Calendar: …for the purpose of fulfilling a contract on the basis of Article 6 (1) sentence 1 letter b DS Block Exemption Regulation or for the purpose of fulfilling pre-contractual measures at the request of the concerned subject on the basis of Article 6 (1) sentence 1 letter b DS Block Exemption Regulation. Failure to provide these data can result in deadlines not being organised and therefore not being able to be met, which is why operational processes are not carried out or stalled.
- Sales contract: …for the purpose of fulfilling the contract and on the basis of Article 6(1) sentence 1 letter b DS Block Exemption Regulation. Failure to provide these data may result in the contract not being able to be concluded. When we deliver goods to you, we pass on your data to the commissioned shipping company as far as these are required for delivery.
- Business partner contact details: …for the purpose of fulfilling the contract with the concerned subject on the basis of Article 6(1) sentence 1 letter b DS Block Exemption Regulation. If these data are not provided, business partners may not be able to be contacted.
- Cost estimate: …for the purpose of pre-contractual measures at the request of the concerned subject on the basis of Article 6(1), first sentence, point (b) of the DS Block Exemption Regulation. Failure to provide these data may result in a cost estimate not being prepared.
- Customer service: …for the purpose of pre-contractual measures at the request of the concerned subject on the basis of Article 6(1), first sentence, point (b) of the DS Block Exemption Regulation and for the purpose of fulfilling the contract and on the basis of Article 6(1), first sentence, point (b) of the DS Block Exemption Regulation. Failure to provide these data may result in the interested party or customer not being able to be served and contractual obligations not being fulfilled.
- Reminders: …for the purpose of fulfilling the contract and on the basis of Article 6 (1) sentence 1 letter b DS-GVO. Failure to provide these data may result in outstanding debts not being recovered.
- Project and development tickets: …for the purpose of pre-contractual measures at the request of the concerned subject on the basis of Article 6(1)(1)(b) DS Block Exemption Regulation and for the purpose of fulfilling the contract and on the basis of Article 6(1)(1)(b) DS Block Exemption Regulation. Failure to provide these data may result in the prospect or customer not being able to be served directly and internal work processes may come to a standstill.
- Invoices: …for the purpose of fulfilling the contract and on the basis of Article 6 (1) sentence 1 letter b DS-GVO. If these data are not provided, the services may not be invoiced.
- Complaints: …for the purpose of fulfilling the contract and on the basis of Article 6 (1) sentence 1 letter b DS Block Exemption Regulation and for the purpose of fulfilling a legal obligation of the responsible party on the basis of Article 6 (1) sentence 1 letter c DS Block Exemption Regulation. Failure to provide these data may result in the complaint not being processed.
- Reservations: …for the purpose of fulfilling the contract and on the basis of Article 6 (1) sentence 1 letter b DS-GVO. Failure to provide these data may result in the reservations not being able to be made.
- Damage claims: …for the purpose of fulfilling the contract and on the basis of Article 6 (1) sentence 1 letter b DS Block Exemption Regulation and for the purpose of fulfilling a legal obligation of the responsible party on the basis of Article 6 (1) sentence 1 letter c DS Block Exemption Regulation. Failure to provide these data may result in the loss not being able to be settled.
- Switchboard: …for the purpose of pre-contractual measures at the request of the concerned subject on the basis of Article 6(1)(1)(b) DS Block Exemption Regulation and for the purpose of fulfilling the contract and on the basis of Article 6(1)(1)(b) DS Block Exemption Regulation. Failure to provide these data may result in calls not being handled properly.
- Transfer: …for the purpose of fulfilling the contract with the concerned subject and on the basis of Article 6(1) first sentence (b) of the DS Block Exemption Regulation. Failure to provide these data may result in a data transfer not being carried out, which may delay the introduction of the system by the customer.
- Contract management: …for the purpose of fulfilling the contract and on the basis of Article 6(1) sentence 1 letter b DS Block Exemption Regulation. If these data are not made available, contracts may not be concluded and managed.
- Distribution to business customers: …for the purpose of pre-contractual measures at the request of the concerned subject on the basis of Article 6(1) first sentence (b) of the DS Block Exemption Regulation. Failure to provide this information may result in goods or services not being sold.
We transfer personal data to responsible employees/departments in the company (sales/sales, marketing, accounting, service, project management, customer advisors, management), tax consultants, lawyers and our parent company.
Further processing will only take place if you have given your consent or if there is legal permission.
To some extent, we use external service providers based in the European Economic Area to process your data. These service providers have been carefully selected by us, commissioned in writing and are bound by our instructions. We check them on a regular basis. The service providers will not pass these data on to third parties, but will delete it after fulfilment of the contract and the conclusion of statutory storage periods, unless you have consented to further storage.
The personal data are also transferred to our parent company in Switzerland. The Commission has taken a adequacy decision pursuant to Article 45(3) of the DS Block Exemption Regulation.
In addition, we may provide information on the relevant facts to a lawyer. This is done in accordance with legal requirements, insofar as it is necessary to protect our legitimate interests and the legitimate interests of third parties and there is no reason to assume that your interests or fundamental rights and freedoms, which require the protection of personal data, prevail. The collection, storage and transfer of data is therefore carried out for the purpose of operational interests on the basis of Article 6 (1) sentence 1 letter f DS-GVO.
We maintain current technical measures to ensure the protection of personal data. These will be adapted to the current state of the art.
3. Duration of data storage
If we do not process your contact data for operational purposes, we will store the collected data until the purpose for which the data was collected has been fulfilled and is no longer necessary, or
- Offers: …until the end of the 10-year period or, if no contract is concluded, immediately thereafter. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Order confirmation: …until the end of the 10-year period. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- CRM system without merchandise management: …until the legal retention period of 10 years expires. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Data management: …until the end of the 10-year period. We retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period, the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Document management: …until the end of the 10-year period. We retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period, the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Electronic payments: …until the end of the statutory retention period of 10 years. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Financial accounting: …until the end of the 10-year period. We keep the data of the contractual relationship information required under commercial and tax law for the legally specified periods on the basis of Article 6 paragraph 1 sentence 1 letter c DS-GVO. For this period (10 years on a regular basis), the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Calendar: …until the end of the 10-year period. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Purchase contract: …until expiry of the statutory or possible contractual warranty and guarantee rights. After expiry of these periods, we shall retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period (usually 10 years from the conclusion of the contract), the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Business partner contact details: …until the end of the 10-year period. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Cost estimate: …until the end of the 10-year period. We retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period, the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Customer service: …until the end of the 10-year period. We retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period, the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Reminders: …until the end of the 10-year period. After expiry of these periods, we shall retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period (usually 10 years from the conclusion of the contract), the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Project and development tickets: …until the end of the 10-year period. We retain the information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS Block Exemption Regulation. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Invoices: …until the end of the 10-year period. We retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period, the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Complaints: …until the end of the 10-year period. We keep the data of the contractual relationship information required under commercial and tax law for the legally specified periods on the basis of Article 6 paragraph 1 sentence 1 letter c DS-GVO. For this period (10 years on a regular basis), the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Reservations: …until the expiry of the three-year period. We retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period, the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Damage claims: …until the expiry of the period of 10 years. We keep the data of the contractual relationship information required under commercial and tax law for the legally specified periods on the basis of Article 6 paragraph 1 sentence 1 letter c DS-GVO. For this period (10 years on a regular basis), the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Switchboard: …until the end of a 3-year period. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Transfer: …until the end of the 10-year period. We retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period, the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Contract management: …until the end of the 10-year period. We retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period, the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
- Sales to business customers: …until the end of the 10-year period. We retain the contractual relationship information required under commercial and tax law for the periods specified by law on the basis of Article 6 (1) sentence 1 letter c DS-GVO. For this period, the data will be reprocessed only in the event of verification by the tax authorities. Your data will also be deleted if storage is inadmissible. After expiry of this period, the data collected for this procedure will be deleted or blocked if deletion is not possible.
4. Your data protection rights
You have the right to request information from us at any time about the personal data we have stored about you (Article 15 DS-GVO). This also concerns the recipients or categories of recipients to whom these data are disclosed and the purpose of the storage. In addition, you have the right to demand the rectification under the conditions of Article 16 DS Block Exemption Regulation and/or the deletion under the conditions of Article 17 DS Block Exemption Regulation and/or the restriction of processing under the conditions of Article 18 DS Block Exemption Regulation. Furthermore, under the conditions of Article 20 of the DS-GVO, you may request data transmission at any time – provided that the data are still stored by us.
In the case of the processing of personal data for the performance of tasks in the public interest (Article 6(1), first sentence, point (e) DS Block Exemption Regulation) or for the protection of legitimate interests (Article 6(1), first sentence, point (f) DS Block Exemption Regulation), you may object to the processing of your personal data at any time with effect for the future. In the event of objection, we shall refrain from any further processing of your data for the aforementioned purposes unless
- there are compelling grounds for processing worthy of protection, which override your interests, rights and freedoms, or
- the processing is necessary for the assertion, exercise or defence of legal claims.
If the processing of your personal data is based on your consent, you have the right to revoke your consent at any time. This does not affect the lawfulness of the processing carried out on the basis of consent until revocation (Article 7(3) DS Block Exemption Regulation).
Under the conditions described in Article 21(1) of the DS Block Exemption Regulation, data processing may be opposed on grounds relating to the particular situation of the concerned subject.
5. Contact
All requests for information, requests for advice, revocations or objections regarding data processing should be sent by email to our data protection officer at datenschutz@a-f.de or by letter to the address stated under 1. For further information we refer to the complete text of the DS-GVO, which is available under this link, as well as our privacy policy.
In addition, you have the possibility of complaining to the competent supervisory authority about data protection issues:
The State Commissioner for Data Protection Lower Saxony
Barbara Thiel
Prinzenstrasse 5
30159 Hanover
